No OneTemporary
Actions

Authored By

Unknown

Size

49 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/lib/pleroma/plugs/http_security_plug.ex b/lib/pleroma/plugs/http_security_plug.ex
	index 6462797b6..2208d1d6c 100644
	--- a/lib/pleroma/plugs/http_security_plug.ex
	+++ b/lib/pleroma/plugs/http_security_plug.ex
	@@ -1,151 +1,193 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Plugs.HTTPSecurityPlug do
	alias Pleroma.Config
	import Plug.Conn

	require Logger

	def init(opts), do: opts

	def call(conn, _options) do
	if Config.get([:http_security, :enabled]) do
	conn
	\|> merge_resp_headers(headers())
	\|> maybe_send_sts_header(Config.get([:http_security, :sts]))
	else
	conn
	end
	end

	defp headers do
	referrer_policy = Config.get([:http_security, :referrer_policy])
	report_uri = Config.get([:http_security, :report_uri])

	headers = [
	{"x-xss-protection", "1; mode=block"},
	{"x-permitted-cross-domain-policies", "none"},
	{"x-frame-options", "DENY"},
	{"x-content-type-options", "nosniff"},
	{"referrer-policy", referrer_policy},
	{"x-download-options", "noopen"},
	- {"content-security-policy", csp_string() <> ";"}
	+ {"content-security-policy", csp_string()}
	]

	if report_uri do
	report_group = %{
	"group" => "csp-endpoint",
	"max-age" => 10_886_400,
	"endpoints" => [
	%{"url" => report_uri}
	]
	}

	- headers ++ [{"reply-to", Jason.encode!(report_group)}]
	+ [{"reply-to", Jason.encode!(report_group)} \| headers]
	else
	headers
	end
	end

	+ static_csp_rules = [
	+ "default-src 'none'",
	+ "base-uri 'self'",
	+ "frame-ancestors 'none'",
	+ "style-src 'self' 'unsafe-inline'",
	+ "font-src 'self'",
	+ "manifest-src 'self'"
	+ ]
	+
	+ @csp_start [Enum.join(static_csp_rules, ";") <> ";"]
	+
	defp csp_string do
	scheme = Config.get([Pleroma.Web.Endpoint, :url])[:scheme]
	static_url = Pleroma.Web.Endpoint.static_url()
	websocket_url = Pleroma.Web.Endpoint.websocket_url()
	report_uri = Config.get([:http_security, :report_uri])

	- connect_src = "connect-src 'self' #{static_url} #{websocket_url}"
	+ img_src = "img-src 'self' data: blob:"
	+ media_src = "media-src 'self'"
	+
	+ {img_src, media_src} =
	+ if Config.get([:media_proxy, :enabled]) &&
	+ !Config.get([:media_proxy, :proxy_opts, :redirect_on_failure]) do
	+ sources = get_proxy_and_attachment_sources()
	+ {[img_src, sources], [media_src, sources]}
	+ else
	+ {img_src, media_src}
	+ end
	+
	+ connect_src = ["connect-src 'self' ", static_url, ?\s, websocket_url]

	connect_src =
	if Pleroma.Config.get(:env) == :dev do
	- connect_src <> " http://localhost:3035/"
	+ [connect_src, " http://localhost:3035/"]
	else
	connect_src
	end

	script_src =
	if Pleroma.Config.get(:env) == :dev do
	"script-src 'self' 'unsafe-eval'"
	else
	"script-src 'self'"
	end

	- main_part = [
	- "default-src 'none'",
	- "base-uri 'self'",
	- "frame-ancestors 'none'",
	- "img-src 'self' data: blob: https:",
	- "media-src 'self' https:",
	- "style-src 'self' 'unsafe-inline'",
	- "font-src 'self'",
	- "manifest-src 'self'",
	- connect_src,
	- script_src
	- ]
	+ report = if report_uri, do: ["report-uri ", report_uri, ";report-to csp-endpoint"]
	+ insecure = if scheme == "https", do: "upgrade-insecure-requests"
	+
	+ @csp_start
	+ \|> add_csp_param(img_src)
	+ \|> add_csp_param(media_src)
	+ \|> add_csp_param(connect_src)
	+ \|> add_csp_param(script_src)
	+ \|> add_csp_param(insecure)
	+ \|> add_csp_param(report)
	+ \|> :erlang.iolist_to_binary()
	+ end
	+
	+ defp get_proxy_and_attachment_sources do
	+ media_proxy_whitelist =
	+ Enum.reduce(Config.get([:media_proxy, :whitelist]), [], fn host, acc ->
	+ add_source(acc, host)
	+ end)

	- report = if report_uri, do: ["report-uri #{report_uri}; report-to csp-endpoint"], else: []
	+ upload_base_url =
	+ if Config.get([Pleroma.Upload, :base_url]),
	+ do: URI.parse(Config.get([Pleroma.Upload, :base_url])).host

	- insecure = if scheme == "https", do: ["upgrade-insecure-requests"], else: []
	+ s3_endpoint =
	+ if Config.get([Pleroma.Upload, :uploader]) == Pleroma.Uploaders.S3,
	+ do: URI.parse(Config.get([Pleroma.Uploaders.S3, :public_endpoint])).host

	- (main_part ++ report ++ insecure)
	- \|> Enum.join("; ")
	+ []
	+ \|> add_source(upload_base_url)
	+ \|> add_source(s3_endpoint)
	+ \|> add_source(media_proxy_whitelist)
	end

	+ defp add_source(iodata, nil), do: iodata
	+ defp add_source(iodata, source), do: [[?\s, source] \| iodata]
	+
	+ defp add_csp_param(csp_iodata, nil), do: csp_iodata
	+
	+ defp add_csp_param(csp_iodata, param), do: [[param, ?;] \| csp_iodata]
	+
	def warn_if_disabled do
	unless Config.get([:http_security, :enabled]) do
	Logger.warn("
	.i;;;;i.
	iYcviii;vXY:
	.YXi .i1c.
	.YC. . in7.
	.vc. ...... ;1c.
	i7, .. .;1;
	i7, .. ... .Y1i
	,7v .6MMM@; .YX,
	.7;. ..IMMMMMM1 :t7.
	.;Y. ;$MMMMMM9. :tc.
	vY. .. .nMMM@MMU. ;1v.
	i7i ... .#MM@M@C. .....:71i
	it: .... $MMM@9;.,i;;;i,;tti
	:t7. ..... 0MMMWv.,iii:::,,;St.
	.nC. ..... IMMMQ..,::::::,.,czX.
	.ct: ....... .ZMMMI..,:::::::,,:76Y.
	c2: ......,i..Y$M@t..:::::::,,..inZY
	vov ......:ii..c$MBc..,,,,,,,,,,..iI9i
	i9Y ......iii:..7@MA,..,,,,,,,,,....;AA:
	iIS. ......:ii::..;@MI....,............;Ez.
	.I9. ......:i::::...8M1..................C0z.
	.z9; ......:i::::,.. .i:...................zWX.
	vbv ......,i::::,,. ................. :AQY
	c6Y. .,...,::::,,..:t0@@QY. ................ :8bi
	:6S. ..,,...,:::,,,..EMMMMMMI. ............... .;bZ,
	:6o, .,,,,..:::,,,..i#MMMMMM#v................. YW2.
	.n8i ..,,,,,,,::,,,,.. tMMMMM@C:.................. .1Wn
	7Uc. .:::,,,,,::,,,,.. i1t;,..................... .UEi
	7C...::::::::::::,,,,.. .................... vSi.
	;1;...,,::::::,......... .................. Yz:
	v97,......... .voC.
	izAotX7777777777777777777777777777777777777777Y7n92:
	.;CoIIIIIUAA666666699999ZZZZZZZZZZZZZZZZZZZZ6ov.

	HTTP Security is disabled. Please re-enable it to prevent users from attacking
	your instance and your users via malicious posts:

	config :pleroma, :http_security, enabled: true
	")
	end
	end

	defp maybe_send_sts_header(conn, true) do
	max_age_sts = Config.get([:http_security, :sts_max_age])
	max_age_ct = Config.get([:http_security, :ct_max_age])

	merge_resp_headers(conn, [
	{"strict-transport-security", "max-age=#{max_age_sts}; includeSubDomains"},
	{"expect-ct", "enforce, max-age=#{max_age_ct}"}
	])
	end

	defp maybe_send_sts_header(conn, _), do: conn
	end
	diff --git a/lib/pleroma/web/mastodon_api/views/account_view.ex b/lib/pleroma/web/mastodon_api/views/account_view.ex
	index 45fffaad2..04c419d2f 100644
	--- a/lib/pleroma/web/mastodon_api/views/account_view.ex
	+++ b/lib/pleroma/web/mastodon_api/views/account_view.ex
	@@ -1,382 +1,384 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.AccountView do
	use Pleroma.Web, :view

	alias Pleroma.FollowingRelationship
	alias Pleroma.User
	alias Pleroma.UserRelationship
	alias Pleroma.Web.CommonAPI.Utils
	alias Pleroma.Web.MastodonAPI.AccountView
	alias Pleroma.Web.MediaProxy

	def render("index.json", %{users: users} = opts) do
	reading_user = opts[:for]

	relationships_opt =
	cond do
	Map.has_key?(opts, :relationships) ->
	opts[:relationships]

	is_nil(reading_user) \|\| !opts[:embed_relationships] ->
	UserRelationship.view_relationships_option(nil, [])

	true ->
	UserRelationship.view_relationships_option(reading_user, users)
	end

	opts = Map.put(opts, :relationships, relationships_opt)

	users
	\|> render_many(AccountView, "show.json", opts)
	\|> Enum.filter(&Enum.any?/1)
	end

	def render("show.json", %{user: user} = opts) do
	if User.visible_for?(user, opts[:for]) do
	do_render("show.json", opts)
	else
	%{}
	end
	end

	def render("mention.json", %{user: user}) do
	%{
	id: to_string(user.id),
	acct: user.nickname,
	username: username_from_nickname(user.nickname),
	url: user.uri \|\| user.ap_id
	}
	end

	def render("relationship.json", %{user: nil, target: _target}) do
	%{}
	end

	def render(
	"relationship.json",
	%{user: %User{} = reading_user, target: %User{} = target} = opts
	) do
	user_relationships = get_in(opts, [:relationships, :user_relationships])
	following_relationships = get_in(opts, [:relationships, :following_relationships])

	follow_state =
	if following_relationships do
	user_to_target_following_relation =
	FollowingRelationship.find(following_relationships, reading_user, target)

	User.get_follow_state(reading_user, target, user_to_target_following_relation)
	else
	User.get_follow_state(reading_user, target)
	end

	followed_by =
	if following_relationships do
	case FollowingRelationship.find(following_relationships, target, reading_user) do
	%{state: :follow_accept} -> true
	_ -> false
	end
	else
	User.following?(target, reading_user)
	end

	# NOTE: adjust UserRelationship.view_relationships_option/2 on new relation-related flags
	%{
	id: to_string(target.id),
	following: follow_state == :follow_accept,
	followed_by: followed_by,
	blocking:
	UserRelationship.exists?(
	user_relationships,
	:block,
	reading_user,
	target,
	&User.blocks_user?(&1, &2)
	),
	blocked_by:
	UserRelationship.exists?(
	user_relationships,
	:block,
	target,
	reading_user,
	&User.blocks_user?(&1, &2)
	),
	muting:
	UserRelationship.exists?(
	user_relationships,
	:mute,
	reading_user,
	target,
	&User.mutes?(&1, &2)
	),
	muting_notifications:
	UserRelationship.exists?(
	user_relationships,
	:notification_mute,
	reading_user,
	target,
	&User.muted_notifications?(&1, &2)
	),
	subscribing:
	UserRelationship.exists?(
	user_relationships,
	:inverse_subscription,
	target,
	reading_user,
	&User.subscribed_to?(&2, &1)
	),
	requested: follow_state == :follow_pending,
	domain_blocking: User.blocks_domain?(reading_user, target),
	showing_reblogs:
	not UserRelationship.exists?(
	user_relationships,
	:reblog_mute,
	reading_user,
	target,
	&User.muting_reblogs?(&1, &2)
	),
	endorsed: false
	}
	end

	def render("relationships.json", %{user: user, targets: targets} = opts) do
	relationships_opt =
	cond do
	Map.has_key?(opts, :relationships) ->
	opts[:relationships]

	is_nil(user) ->
	UserRelationship.view_relationships_option(nil, [])

	true ->
	UserRelationship.view_relationships_option(user, targets)
	end

	render_opts = %{as: :target, user: user, relationships: relationships_opt}
	render_many(targets, AccountView, "relationship.json", render_opts)
	end

	defp do_render("show.json", %{user: user} = opts) do
	user = User.sanitize_html(user, User.html_filter_policy(opts[:for]))
	display_name = user.name \|\| user.nickname

	image = User.avatar_url(user) \|> MediaProxy.url()
	header = User.banner_url(user) \|> MediaProxy.url()

	following_count =
	if !user.hide_follows_count or !user.hide_follows or opts[:for] == user do
	user.following_count \|\| 0
	else
	0
	end

	followers_count =
	if !user.hide_followers_count or !user.hide_followers or opts[:for] == user do
	user.follower_count \|\| 0
	else
	0
	end

	bot = user.actor_type in ["Application", "Service"]

	emojis =
	- Enum.map(user.emoji, fn {shortcode, url} ->
	+ Enum.map(user.emoji, fn {shortcode, raw_url} ->
	+ url = MediaProxy.url(raw_url)
	+
	%{
	- "shortcode" => shortcode,
	- "url" => url,
	- "static_url" => url,
	- "visible_in_picker" => false
	+ shortcode: shortcode,
	+ url: url,
	+ static_url: url,
	+ visible_in_picker: false
	}
	end)

	relationship =
	if opts[:embed_relationships] do
	render("relationship.json", %{
	user: opts[:for],
	target: user,
	relationships: opts[:relationships]
	})
	else
	%{}
	end

	%{
	id: to_string(user.id),
	username: username_from_nickname(user.nickname),
	acct: user.nickname,
	display_name: display_name,
	locked: user.locked,
	created_at: Utils.to_masto_date(user.inserted_at),
	followers_count: followers_count,
	following_count: following_count,
	statuses_count: user.note_count,
	note: user.bio \|\| "",
	url: user.uri \|\| user.ap_id,
	avatar: image,
	avatar_static: image,
	header: header,
	header_static: header,
	emojis: emojis,
	fields: user.fields,
	bot: bot,
	source: %{
	note: prepare_user_bio(user),
	sensitive: false,
	fields: user.raw_fields,
	pleroma: %{
	discoverable: user.discoverable,
	actor_type: user.actor_type
	}
	},

	# Pleroma extension
	pleroma: %{
	confirmation_pending: user.confirmation_pending,
	tags: user.tags,
	hide_followers_count: user.hide_followers_count,
	hide_follows_count: user.hide_follows_count,
	hide_followers: user.hide_followers,
	hide_follows: user.hide_follows,
	hide_favorites: user.hide_favorites,
	relationship: relationship,
	skip_thread_containment: user.skip_thread_containment,
	background_image: image_url(user.background) \|> MediaProxy.url()
	}
	}
	\|> maybe_put_role(user, opts[:for])
	\|> maybe_put_settings(user, opts[:for], opts)
	\|> maybe_put_notification_settings(user, opts[:for])
	\|> maybe_put_settings_store(user, opts[:for], opts)
	\|> maybe_put_chat_token(user, opts[:for], opts)
	\|> maybe_put_activation_status(user, opts[:for])
	\|> maybe_put_follow_requests_count(user, opts[:for])
	\|> maybe_put_allow_following_move(user, opts[:for])
	\|> maybe_put_unread_conversation_count(user, opts[:for])
	\|> maybe_put_unread_notification_count(user, opts[:for])
	end

	defp prepare_user_bio(%User{bio: ""}), do: ""

	defp prepare_user_bio(%User{bio: bio}) when is_binary(bio) do
	bio
	\|> String.replace(~r(<br */?>), "\n")
	\|> Pleroma.HTML.strip_tags()
	\|> HtmlEntities.decode()
	end

	defp prepare_user_bio(_), do: ""

	defp username_from_nickname(string) when is_binary(string) do
	hd(String.split(string, "@"))
	end

	defp username_from_nickname(_), do: nil

	defp maybe_put_follow_requests_count(
	data,
	%User{id: user_id} = user,
	%User{id: user_id}
	) do
	count =
	User.get_follow_requests(user)
	\|> length()

	data
	\|> Kernel.put_in([:follow_requests_count], count)
	end

	defp maybe_put_follow_requests_count(data, _, _), do: data

	defp maybe_put_settings(
	data,
	%User{id: user_id} = user,
	%User{id: user_id},
	_opts
	) do
	data
	\|> Kernel.put_in([:source, :privacy], user.default_scope)
	\|> Kernel.put_in([:source, :pleroma, :show_role], user.show_role)
	\|> Kernel.put_in([:source, :pleroma, :no_rich_text], user.no_rich_text)
	end

	defp maybe_put_settings(data, _, _, _), do: data

	defp maybe_put_settings_store(data, %User{} = user, %User{}, %{
	with_pleroma_settings: true
	}) do
	data
	\|> Kernel.put_in([:pleroma, :settings_store], user.pleroma_settings_store)
	end

	defp maybe_put_settings_store(data, _, _, _), do: data

	defp maybe_put_chat_token(data, %User{id: id}, %User{id: id}, %{
	with_chat_token: token
	}) do
	data
	\|> Kernel.put_in([:pleroma, :chat_token], token)
	end

	defp maybe_put_chat_token(data, _, _, _), do: data

	defp maybe_put_role(data, %User{show_role: true} = user, _) do
	data
	\|> Kernel.put_in([:pleroma, :is_admin], user.is_admin)
	\|> Kernel.put_in([:pleroma, :is_moderator], user.is_moderator)
	end

	defp maybe_put_role(data, %User{id: user_id} = user, %User{id: user_id}) do
	data
	\|> Kernel.put_in([:pleroma, :is_admin], user.is_admin)
	\|> Kernel.put_in([:pleroma, :is_moderator], user.is_moderator)
	end

	defp maybe_put_role(data, _, _), do: data

	defp maybe_put_notification_settings(data, %User{id: user_id} = user, %User{id: user_id}) do
	Kernel.put_in(
	data,
	[:pleroma, :notification_settings],
	Map.from_struct(user.notification_settings)
	)
	end

	defp maybe_put_notification_settings(data, _, _), do: data

	defp maybe_put_allow_following_move(data, %User{id: user_id} = user, %User{id: user_id}) do
	Kernel.put_in(data, [:pleroma, :allow_following_move], user.allow_following_move)
	end

	defp maybe_put_allow_following_move(data, _, _), do: data

	defp maybe_put_activation_status(data, user, %User{is_admin: true}) do
	Kernel.put_in(data, [:pleroma, :deactivated], user.deactivated)
	end

	defp maybe_put_activation_status(data, _, _), do: data

	defp maybe_put_unread_conversation_count(data, %User{id: user_id} = user, %User{id: user_id}) do
	data
	\|> Kernel.put_in(
	[:pleroma, :unread_conversation_count],
	user.unread_conversation_count
	)
	end

	defp maybe_put_unread_conversation_count(data, _, _), do: data

	defp maybe_put_unread_notification_count(data, %User{id: user_id}, %User{id: user_id} = user) do
	Kernel.put_in(
	data,
	[:pleroma, :unread_notifications_count],
	Pleroma.Notification.unread_notifications_count(user)
	)
	end

	defp maybe_put_unread_notification_count(data, _, _), do: data

	defp image_url(%{"url" => [%{"href" => href} \| _]}), do: href
	defp image_url(_), do: nil
	end
	diff --git a/test/plugs/http_security_plug_test.exs b/test/plugs/http_security_plug_test.exs
	index 84e4c274f..63b4d3f31 100644
	--- a/test/plugs/http_security_plug_test.exs
	+++ b/test/plugs/http_security_plug_test.exs
	@@ -1,92 +1,92 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Plugs.HTTPSecurityPlugTest do
	use Pleroma.Web.ConnCase
	alias Pleroma.Config
	alias Plug.Conn

	setup do: clear_config([:http_securiy, :enabled])
	setup do: clear_config([:http_security, :sts])
	setup do: clear_config([:http_security, :referrer_policy])

	describe "http security enabled" do
	setup do
	Config.put([:http_security, :enabled], true)
	end

	test "it sends CSP headers when enabled", %{conn: conn} do
	conn = get(conn, "/api/v1/instance")

	refute Conn.get_resp_header(conn, "x-xss-protection") == []
	refute Conn.get_resp_header(conn, "x-permitted-cross-domain-policies") == []
	refute Conn.get_resp_header(conn, "x-frame-options") == []
	refute Conn.get_resp_header(conn, "x-content-type-options") == []
	refute Conn.get_resp_header(conn, "x-download-options") == []
	refute Conn.get_resp_header(conn, "referrer-policy") == []
	refute Conn.get_resp_header(conn, "content-security-policy") == []
	end

	test "it sends STS headers when enabled", %{conn: conn} do
	Config.put([:http_security, :sts], true)

	conn = get(conn, "/api/v1/instance")

	refute Conn.get_resp_header(conn, "strict-transport-security") == []
	refute Conn.get_resp_header(conn, "expect-ct") == []
	end

	test "it does not send STS headers when disabled", %{conn: conn} do
	Config.put([:http_security, :sts], false)

	conn = get(conn, "/api/v1/instance")

	assert Conn.get_resp_header(conn, "strict-transport-security") == []
	assert Conn.get_resp_header(conn, "expect-ct") == []
	end

	test "referrer-policy header reflects configured value", %{conn: conn} do
	conn = get(conn, "/api/v1/instance")

	assert Conn.get_resp_header(conn, "referrer-policy") == ["same-origin"]

	Config.put([:http_security, :referrer_policy], "no-referrer")

	conn =
	build_conn()
	\|> get("/api/v1/instance")

	assert Conn.get_resp_header(conn, "referrer-policy") == ["no-referrer"]
	end

	test "it sends `report-to` & `report-uri` CSP response headers" do
	conn =
	build_conn()
	\|> get("/api/v1/instance")

	[csp] = Conn.get_resp_header(conn, "content-security-policy")

	- assert csp =~ ~r\|report-uri https://endpoint.com; report-to csp-endpoint;\|
	+ assert csp =~ ~r\|report-uri https://endpoint.com;report-to csp-endpoint;\|

	[reply_to] = Conn.get_resp_header(conn, "reply-to")

	assert reply_to ==
	"{\"endpoints\":[{\"url\":\"https://endpoint.com\"}],\"group\":\"csp-endpoint\",\"max-age\":10886400}"
	end
	end

	test "it does not send CSP headers when disabled", %{conn: conn} do
	Config.put([:http_security, :enabled], false)

	conn = get(conn, "/api/v1/instance")

	assert Conn.get_resp_header(conn, "x-xss-protection") == []
	assert Conn.get_resp_header(conn, "x-permitted-cross-domain-policies") == []
	assert Conn.get_resp_header(conn, "x-frame-options") == []
	assert Conn.get_resp_header(conn, "x-content-type-options") == []
	assert Conn.get_resp_header(conn, "x-download-options") == []
	assert Conn.get_resp_header(conn, "referrer-policy") == []
	assert Conn.get_resp_header(conn, "content-security-policy") == []
	end
	end
	diff --git a/test/web/mastodon_api/views/account_view_test.exs b/test/web/mastodon_api/views/account_view_test.exs
	index 487ec26c2..f91333e5c 100644
	--- a/test/web/mastodon_api/views/account_view_test.exs
	+++ b/test/web/mastodon_api/views/account_view_test.exs
	@@ -1,494 +1,521 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.AccountViewTest do
	use Pleroma.DataCase

	alias Pleroma.User
	alias Pleroma.UserRelationship
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.MastodonAPI.AccountView

	import Pleroma.Factory
	import Tesla.Mock

	setup do
	mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
	:ok
	end

	test "Represent a user account" do
	background_image = %{
	"url" => [%{"href" => "https://example.com/images/asuka_hospital.png"}]
	}

	user =
	insert(:user, %{
	follower_count: 3,
	note_count: 5,
	background: background_image,
	nickname: "shp@shitposter.club",
	name: ":karjalanpiirakka: shp",
	bio:
	"<script src=\"invalid-html\"></script><span>valid html</span>. a<br>b<br/>c<br >d<br />f '&<>\"",
	inserted_at: ~N[2017-08-15 15:47:06.597036],
	emoji: %{"karjalanpiirakka" => "/file.png"}
	})

	expected = %{
	id: to_string(user.id),
	username: "shp",
	acct: user.nickname,
	display_name: user.name,
	locked: false,
	created_at: "2017-08-15T15:47:06.000Z",
	followers_count: 3,
	following_count: 0,
	statuses_count: 5,
	note: "<span>valid html</span>. a<br/>b<br/>c<br/>d<br/>f '&<>"",
	url: user.ap_id,
	avatar: "http://localhost:4001/images/avi.png",
	avatar_static: "http://localhost:4001/images/avi.png",
	header: "http://localhost:4001/images/banner.png",
	header_static: "http://localhost:4001/images/banner.png",
	emojis: [
	%{
	- "static_url" => "/file.png",
	- "url" => "/file.png",
	- "shortcode" => "karjalanpiirakka",
	- "visible_in_picker" => false
	+ static_url: "/file.png",
	+ url: "/file.png",
	+ shortcode: "karjalanpiirakka",
	+ visible_in_picker: false
	}
	],
	fields: [],
	bot: false,
	source: %{
	note: "valid html. a\nb\nc\nd\nf '&<>\"",
	sensitive: false,
	pleroma: %{
	actor_type: "Person",
	discoverable: false
	},
	fields: []
	},
	pleroma: %{
	background_image: "https://example.com/images/asuka_hospital.png",
	confirmation_pending: false,
	tags: [],
	is_admin: false,
	is_moderator: false,
	hide_favorites: true,
	hide_followers: false,
	hide_follows: false,
	hide_followers_count: false,
	hide_follows_count: false,
	relationship: %{},
	skip_thread_containment: false
	}
	}

	assert expected == AccountView.render("show.json", %{user: user})
	end

	test "Represent the user account for the account owner" do
	user = insert(:user)

	notification_settings = %{
	followers: true,
	follows: true,
	non_followers: true,
	non_follows: true,
	privacy_option: false
	}

	privacy = user.default_scope

	assert %{
	pleroma: %{notification_settings: ^notification_settings, allow_following_move: true},
	source: %{privacy: ^privacy}
	} = AccountView.render("show.json", %{user: user, for: user})
	end

	test "Represent a Service(bot) account" do
	user =
	insert(:user, %{
	follower_count: 3,
	note_count: 5,
	actor_type: "Service",
	nickname: "shp@shitposter.club",
	inserted_at: ~N[2017-08-15 15:47:06.597036]
	})

	expected = %{
	id: to_string(user.id),
	username: "shp",
	acct: user.nickname,
	display_name: user.name,
	locked: false,
	created_at: "2017-08-15T15:47:06.000Z",
	followers_count: 3,
	following_count: 0,
	statuses_count: 5,
	note: user.bio,
	url: user.ap_id,
	avatar: "http://localhost:4001/images/avi.png",
	avatar_static: "http://localhost:4001/images/avi.png",
	header: "http://localhost:4001/images/banner.png",
	header_static: "http://localhost:4001/images/banner.png",
	emojis: [],
	fields: [],
	bot: true,
	source: %{
	note: user.bio,
	sensitive: false,
	pleroma: %{
	actor_type: "Service",
	discoverable: false
	},
	fields: []
	},
	pleroma: %{
	background_image: nil,
	confirmation_pending: false,
	tags: [],
	is_admin: false,
	is_moderator: false,
	hide_favorites: true,
	hide_followers: false,
	hide_follows: false,
	hide_followers_count: false,
	hide_follows_count: false,
	relationship: %{},
	skip_thread_containment: false
	}
	}

	assert expected == AccountView.render("show.json", %{user: user})
	end

	test "Represent a Funkwhale channel" do
	{:ok, user} =
	User.get_or_fetch_by_ap_id(
	"https://channels.tests.funkwhale.audio/federation/actors/compositions"
	)

	assert represented = AccountView.render("show.json", %{user: user})
	assert represented.acct == "compositions@channels.tests.funkwhale.audio"
	assert represented.url == "https://channels.tests.funkwhale.audio/channels/compositions"
	end

	test "Represent a deactivated user for an admin" do
	admin = insert(:user, is_admin: true)
	deactivated_user = insert(:user, deactivated: true)
	represented = AccountView.render("show.json", %{user: deactivated_user, for: admin})
	assert represented[:pleroma][:deactivated] == true
	end

	test "Represent a smaller mention" do
	user = insert(:user)

	expected = %{
	id: to_string(user.id),
	acct: user.nickname,
	username: user.nickname,
	url: user.ap_id
	}

	assert expected == AccountView.render("mention.json", %{user: user})
	end

	describe "relationship" do
	defp test_relationship_rendering(user, other_user, expected_result) do
	opts = %{user: user, target: other_user, relationships: nil}
	assert expected_result == AccountView.render("relationship.json", opts)

	relationships_opt = UserRelationship.view_relationships_option(user, [other_user])
	opts = Map.put(opts, :relationships, relationships_opt)
	assert expected_result == AccountView.render("relationship.json", opts)

	assert [expected_result] ==
	AccountView.render("relationships.json", %{user: user, targets: [other_user]})
	end

	@blank_response %{
	following: false,
	followed_by: false,
	blocking: false,
	blocked_by: false,
	muting: false,
	muting_notifications: false,
	subscribing: false,
	requested: false,
	domain_blocking: false,
	showing_reblogs: true,
	endorsed: false
	}

	test "represent a relationship for the following and followed user" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, user} = User.follow(user, other_user)
	{:ok, other_user} = User.follow(other_user, user)
	{:ok, _subscription} = User.subscribe(user, other_user)
	{:ok, _user_relationships} = User.mute(user, other_user, true)
	{:ok, _reblog_mute} = CommonAPI.hide_reblogs(user, other_user)

	expected =
	Map.merge(
	@blank_response,
	%{
	following: true,
	followed_by: true,
	muting: true,
	muting_notifications: true,
	subscribing: true,
	showing_reblogs: false,
	id: to_string(other_user.id)
	}
	)

	test_relationship_rendering(user, other_user, expected)
	end

	test "represent a relationship for the blocking and blocked user" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, user} = User.follow(user, other_user)
	{:ok, _subscription} = User.subscribe(user, other_user)
	{:ok, _user_relationship} = User.block(user, other_user)
	{:ok, _user_relationship} = User.block(other_user, user)

	expected =
	Map.merge(
	@blank_response,
	%{following: false, blocking: true, blocked_by: true, id: to_string(other_user.id)}
	)

	test_relationship_rendering(user, other_user, expected)
	end

	test "represent a relationship for the user blocking a domain" do
	user = insert(:user)
	other_user = insert(:user, ap_id: "https://bad.site/users/other_user")

	{:ok, user} = User.block_domain(user, "bad.site")

	expected =
	Map.merge(
	@blank_response,
	%{domain_blocking: true, blocking: false, id: to_string(other_user.id)}
	)

	test_relationship_rendering(user, other_user, expected)
	end

	test "represent a relationship for the user with a pending follow request" do
	user = insert(:user)
	other_user = insert(:user, locked: true)

	{:ok, user, other_user, _} = CommonAPI.follow(user, other_user)
	user = User.get_cached_by_id(user.id)
	other_user = User.get_cached_by_id(other_user.id)

	expected =
	Map.merge(
	@blank_response,
	%{requested: true, following: false, id: to_string(other_user.id)}
	)

	test_relationship_rendering(user, other_user, expected)
	end
	end

	test "returns the settings store if the requesting user is the represented user and it's requested specifically" do
	user = insert(:user, pleroma_settings_store: %{fe: "test"})

	result =
	AccountView.render("show.json", %{user: user, for: user, with_pleroma_settings: true})

	assert result.pleroma.settings_store == %{:fe => "test"}

	result = AccountView.render("show.json", %{user: user, with_pleroma_settings: true})
	assert result.pleroma[:settings_store] == nil

	result = AccountView.render("show.json", %{user: user, for: user})
	assert result.pleroma[:settings_store] == nil
	end

	test "doesn't sanitize display names" do
	user = insert(:user, name: "<marquee> username </marquee>")
	result = AccountView.render("show.json", %{user: user})
	assert result.display_name == "<marquee> username </marquee>"
	end

	test "never display nil user follow counts" do
	user = insert(:user, following_count: 0, follower_count: 0)
	result = AccountView.render("show.json", %{user: user})

	assert result.following_count == 0
	assert result.followers_count == 0
	end

	describe "hiding follows/following" do
	test "shows when follows/followers stats are hidden and sets follow/follower count to 0" do
	user =
	insert(:user, %{
	hide_followers: true,
	hide_followers_count: true,
	hide_follows: true,
	hide_follows_count: true
	})

	other_user = insert(:user)
	{:ok, user, other_user, _activity} = CommonAPI.follow(user, other_user)
	{:ok, _other_user, user, _activity} = CommonAPI.follow(other_user, user)

	assert %{
	followers_count: 0,
	following_count: 0,
	pleroma: %{hide_follows_count: true, hide_followers_count: true}
	} = AccountView.render("show.json", %{user: user})
	end

	test "shows when follows/followers are hidden" do
	user = insert(:user, hide_followers: true, hide_follows: true)
	other_user = insert(:user)
	{:ok, user, other_user, _activity} = CommonAPI.follow(user, other_user)
	{:ok, _other_user, user, _activity} = CommonAPI.follow(other_user, user)

	assert %{
	followers_count: 1,
	following_count: 1,
	pleroma: %{hide_follows: true, hide_followers: true}
	} = AccountView.render("show.json", %{user: user})
	end

	test "shows actual follower/following count to the account owner" do
	user = insert(:user, hide_followers: true, hide_follows: true)
	other_user = insert(:user)
	{:ok, user, other_user, _activity} = CommonAPI.follow(user, other_user)
	{:ok, _other_user, user, _activity} = CommonAPI.follow(other_user, user)

	assert %{
	followers_count: 1,
	following_count: 1
	} = AccountView.render("show.json", %{user: user, for: user})
	end

	test "shows unread_conversation_count only to the account owner" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, _activity} =
	CommonAPI.post(other_user, %{
	status: "Hey @#{user.nickname}.",
	visibility: "direct"
	})

	user = User.get_cached_by_ap_id(user.ap_id)

	assert AccountView.render("show.json", %{user: user, for: other_user})[:pleroma][
	:unread_conversation_count
	] == nil

	assert AccountView.render("show.json", %{user: user, for: user})[:pleroma][
	:unread_conversation_count
	] == 1
	end

	test "shows unread_count only to the account owner" do
	user = insert(:user)
	insert_list(7, :notification, user: user)
	other_user = insert(:user)

	user = User.get_cached_by_ap_id(user.ap_id)

	assert AccountView.render(
	"show.json",
	%{user: user, for: other_user}
	)[:pleroma][:unread_notifications_count] == nil

	assert AccountView.render(
	"show.json",
	%{user: user, for: user}
	)[:pleroma][:unread_notifications_count] == 7
	end
	end

	describe "follow requests counter" do
	test "shows zero when no follow requests are pending" do
	user = insert(:user)

	assert %{follow_requests_count: 0} =
	AccountView.render("show.json", %{user: user, for: user})

	other_user = insert(:user)
	{:ok, _other_user, user, _activity} = CommonAPI.follow(other_user, user)

	assert %{follow_requests_count: 0} =
	AccountView.render("show.json", %{user: user, for: user})
	end

	test "shows non-zero when follow requests are pending" do
	user = insert(:user, locked: true)

	assert %{locked: true} = AccountView.render("show.json", %{user: user, for: user})

	other_user = insert(:user)
	{:ok, _other_user, user, _activity} = CommonAPI.follow(other_user, user)

	assert %{locked: true, follow_requests_count: 1} =
	AccountView.render("show.json", %{user: user, for: user})
	end

	test "decreases when accepting a follow request" do
	user = insert(:user, locked: true)

	assert %{locked: true} = AccountView.render("show.json", %{user: user, for: user})

	other_user = insert(:user)
	{:ok, other_user, user, _activity} = CommonAPI.follow(other_user, user)

	assert %{locked: true, follow_requests_count: 1} =
	AccountView.render("show.json", %{user: user, for: user})

	{:ok, _other_user} = CommonAPI.accept_follow_request(other_user, user)

	assert %{locked: true, follow_requests_count: 0} =
	AccountView.render("show.json", %{user: user, for: user})
	end

	test "decreases when rejecting a follow request" do
	user = insert(:user, locked: true)

	assert %{locked: true} = AccountView.render("show.json", %{user: user, for: user})

	other_user = insert(:user)
	{:ok, other_user, user, _activity} = CommonAPI.follow(other_user, user)

	assert %{locked: true, follow_requests_count: 1} =
	AccountView.render("show.json", %{user: user, for: user})

	{:ok, _other_user} = CommonAPI.reject_follow_request(other_user, user)

	assert %{locked: true, follow_requests_count: 0} =
	AccountView.render("show.json", %{user: user, for: user})
	end

	test "shows non-zero when historical unapproved requests are present" do
	user = insert(:user, locked: true)

	assert %{locked: true} = AccountView.render("show.json", %{user: user, for: user})

	other_user = insert(:user)
	{:ok, _other_user, user, _activity} = CommonAPI.follow(other_user, user)

	{:ok, user} = User.update_and_set_cache(user, %{locked: false})

	assert %{locked: false, follow_requests_count: 1} =
	AccountView.render("show.json", %{user: user, for: user})
	end
	end
	+
	+ test "uses mediaproxy urls when it's enabled" do
	+ clear_config([:media_proxy, :enabled], true)
	+
	+ user =
	+ insert(:user,
	+ avatar: %{"url" => [%{"href" => "https://evil.website/avatar.png"}]},
	+ banner: %{"url" => [%{"href" => "https://evil.website/banner.png"}]},
	+ emoji: %{"joker_smile" => "https://evil.website/society.png"}
	+ )
	+
	+ AccountView.render("show.json", %{user: user})
	+ \|> Enum.all?(fn
	+ {key, url} when key in [:avatar, :avatar_static, :header, :header_static] ->
	+ String.starts_with?(url, Pleroma.Web.base_url())
	+
	+ {:emojis, emojis} ->
	+ Enum.all?(emojis, fn %{url: url, static_url: static_url} ->
	+ String.starts_with?(url, Pleroma.Web.base_url()) &&
	+ String.starts_with?(static_url, Pleroma.Web.base_url())
	+ end)
	+
	+ _ ->
	+ true
	+ end)
	+ \|> assert()
	+ end
	end
	diff --git a/test/web/media_proxy/media_proxy_test.exs b/test/web/media_proxy/media_proxy_test.exs
	index 69c2d5dae..69d2a71a6 100644
	--- a/test/web/media_proxy/media_proxy_test.exs
	+++ b/test/web/media_proxy/media_proxy_test.exs
	@@ -1,237 +1,229 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MediaProxyTest do
	use ExUnit.Case
	use Pleroma.Tests.Helpers
	import Pleroma.Web.MediaProxy
	alias Pleroma.Web.MediaProxy.MediaProxyController

	setup do: clear_config([:media_proxy, :enabled])
	setup do: clear_config(Pleroma.Upload)

	describe "when enabled" do
	setup do
	Pleroma.Config.put([:media_proxy, :enabled], true)
	:ok
	end

	test "ignores invalid url" do
	assert url(nil) == nil
	assert url("") == nil
	end

	test "ignores relative url" do
	assert url("/local") == "/local"
	assert url("/") == "/"
	end

	test "ignores local url" do
	local_url = Pleroma.Web.Endpoint.url() <> "/hello"
	local_root = Pleroma.Web.Endpoint.url()
	assert url(local_url) == local_url
	assert url(local_root) == local_root
	end

	test "encodes and decodes URL" do
	url = "https://pleroma.soykaf.com/static/logo.png"
	encoded = url(url)

	assert String.starts_with?(
	encoded,
	Pleroma.Config.get([:media_proxy, :base_url], Pleroma.Web.base_url())
	)

	assert String.ends_with?(encoded, "/logo.png")

	assert decode_result(encoded) == url
	end

	test "encodes and decodes URL without a path" do
	url = "https://pleroma.soykaf.com"
	encoded = url(url)
	assert decode_result(encoded) == url
	end

	test "encodes and decodes URL without an extension" do
	url = "https://pleroma.soykaf.com/path/"
	encoded = url(url)
	assert String.ends_with?(encoded, "/path")
	assert decode_result(encoded) == url
	end

	test "encodes and decodes URL and ignores query params for the path" do
	url = "https://pleroma.soykaf.com/static/logo.png?93939393939&bunny=true"
	encoded = url(url)
	assert String.ends_with?(encoded, "/logo.png")
	assert decode_result(encoded) == url
	end

	test "validates signature" do
	secret_key_base = Pleroma.Config.get([Pleroma.Web.Endpoint, :secret_key_base])

	on_exit(fn ->
	Pleroma.Config.put([Pleroma.Web.Endpoint, :secret_key_base], secret_key_base)
	end)

	encoded = url("https://pleroma.social")

	Pleroma.Config.put(
	[Pleroma.Web.Endpoint, :secret_key_base],
	"00000000000000000000000000000000000000000000000"
	)

	[_, "proxy", sig, base64 \| _] = URI.parse(encoded).path \|> String.split("/")
	assert decode_url(sig, base64) == {:error, :invalid_signature}
	end

	test "filename_matches preserves the encoded or decoded path" do
	assert MediaProxyController.filename_matches(
	%{"filename" => "/Hello world.jpg"},
	"/Hello world.jpg",
	"http://pleroma.social/Hello world.jpg"
	) == :ok

	assert MediaProxyController.filename_matches(
	%{"filename" => "/Hello%20world.jpg"},
	"/Hello%20world.jpg",
	"http://pleroma.social/Hello%20world.jpg"
	) == :ok

	assert MediaProxyController.filename_matches(
	%{"filename" => "/my%2Flong%2Furl%2F2019%2F07%2FS.jpg"},
	"/my%2Flong%2Furl%2F2019%2F07%2FS.jpg",
	"http://pleroma.social/my%2Flong%2Furl%2F2019%2F07%2FS.jpg"
	) == :ok

	assert MediaProxyController.filename_matches(
	%{"filename" => "/my%2Flong%2Furl%2F2019%2F07%2FS.jp"},
	"/my%2Flong%2Furl%2F2019%2F07%2FS.jp",
	"http://pleroma.social/my%2Flong%2Furl%2F2019%2F07%2FS.jpg"
	) == {:wrong_filename, "my%2Flong%2Furl%2F2019%2F07%2FS.jpg"}
	end

	test "encoded url are tried to match for proxy as `conn.request_path` encodes the url" do
	# conn.request_path will return encoded url
	request_path = "/ANALYSE-DAI-_-LE-STABLECOIN-100-D%C3%89CENTRALIS%C3%89-BQ.jpg"

	assert MediaProxyController.filename_matches(
	true,
	request_path,
	"https://mydomain.com/uploads/2019/07/ANALYSE-DAI-_-LE-STABLECOIN-100-DÉCENTRALISÉ-BQ.jpg"
	) == :ok
	end

	test "uses the configured base_url" do
	- base_url = Pleroma.Config.get([:media_proxy, :base_url])
	-
	- if base_url do
	- on_exit(fn ->
	- Pleroma.Config.put([:media_proxy, :base_url], base_url)
	- end)
	- end
	-
	- Pleroma.Config.put([:media_proxy, :base_url], "https://cache.pleroma.social")
	+ clear_config([:media_proxy, :base_url], "https://cache.pleroma.social")

	url = "https://pleroma.soykaf.com/static/logo.png"
	encoded = url(url)

	assert String.starts_with?(encoded, Pleroma.Config.get([:media_proxy, :base_url]))
	end

	# Some sites expect ASCII encoded characters in the URL to be preserved even if
	# unnecessary.
	# Issues: https://git.pleroma.social/pleroma/pleroma/issues/580
	# https://git.pleroma.social/pleroma/pleroma/issues/1055
	test "preserve ASCII encoding" do
	url =
	"https://pleroma.com/%20/%21/%22/%23/%24/%25/%26/%27/%28/%29/%2A/%2B/%2C/%2D/%2E/%2F/%30/%31/%32/%33/%34/%35/%36/%37/%38/%39/%3A/%3B/%3C/%3D/%3E/%3F/%40/%41/%42/%43/%44/%45/%46/%47/%48/%49/%4A/%4B/%4C/%4D/%4E/%4F/%50/%51/%52/%53/%54/%55/%56/%57/%58/%59/%5A/%5B/%5C/%5D/%5E/%5F/%60/%61/%62/%63/%64/%65/%66/%67/%68/%69/%6A/%6B/%6C/%6D/%6E/%6F/%70/%71/%72/%73/%74/%75/%76/%77/%78/%79/%7A/%7B/%7C/%7D/%7E/%7F/%80/%81/%82/%83/%84/%85/%86/%87/%88/%89/%8A/%8B/%8C/%8D/%8E/%8F/%90/%91/%92/%93/%94/%95/%96/%97/%98/%99/%9A/%9B/%9C/%9D/%9E/%9F/%C2%A0/%A1/%A2/%A3/%A4/%A5/%A6/%A7/%A8/%A9/%AA/%AB/%AC/%C2%AD/%AE/%AF/%B0/%B1/%B2/%B3/%B4/%B5/%B6/%B7/%B8/%B9/%BA/%BB/%BC/%BD/%BE/%BF/%C0/%C1/%C2/%C3/%C4/%C5/%C6/%C7/%C8/%C9/%CA/%CB/%CC/%CD/%CE/%CF/%D0/%D1/%D2/%D3/%D4/%D5/%D6/%D7/%D8/%D9/%DA/%DB/%DC/%DD/%DE/%DF/%E0/%E1/%E2/%E3/%E4/%E5/%E6/%E7/%E8/%E9/%EA/%EB/%EC/%ED/%EE/%EF/%F0/%F1/%F2/%F3/%F4/%F5/%F6/%F7/%F8/%F9/%FA/%FB/%FC/%FD/%FE/%FF"

	encoded = url(url)
	assert decode_result(encoded) == url
	end

	# This includes unsafe/reserved characters which are not interpreted as part of the URL
	# and would otherwise have to be ASCII encoded. It is our role to ensure the proxied URL
	# is unmodified, so we are testing these characters anyway.
	test "preserve non-unicode characters per RFC3986" do
	url =
	"https://pleroma.com/ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz1234567890-._~:/?#[]@!$&'()*+,;=\|^`{}"

	encoded = url(url)
	assert decode_result(encoded) == url
	end

	test "preserve unicode characters" do
	url = "https://ko.wikipedia.org/wiki/위키백과:대문"

	encoded = url(url)
	assert decode_result(encoded) == url
	end
	end

	describe "when disabled" do
	setup do
	enabled = Pleroma.Config.get([:media_proxy, :enabled])

	if enabled do
	Pleroma.Config.put([:media_proxy, :enabled], false)

	on_exit(fn ->
	Pleroma.Config.put([:media_proxy, :enabled], enabled)
	:ok
	end)
	end

	:ok
	end

	test "does not encode remote urls" do
	assert url("https://google.fr") == "https://google.fr"
	end
	end

	defp decode_result(encoded) do
	[_, "proxy", sig, base64 \| _] = URI.parse(encoded).path \|> String.split("/")
	{:ok, decoded} = decode_url(sig, base64)
	decoded
	end

	describe "whitelist" do
	setup do
	Pleroma.Config.put([:media_proxy, :enabled], true)
	:ok
	end

	test "mediaproxy whitelist" do
	Pleroma.Config.put([:media_proxy, :whitelist], ["google.com", "feld.me"])
	url = "https://feld.me/foo.png"

	unencoded = url(url)
	assert unencoded == url
	end

	test "does not change whitelisted urls" do
	- Pleroma.Config.put([:media_proxy, :whitelist], ["mycdn.akamai.com"])
	- Pleroma.Config.put([:media_proxy, :base_url], "https://cache.pleroma.social")
	+ clear_config([:media_proxy, :whitelist], ["mycdn.akamai.com"])
	+ clear_config([:media_proxy, :base_url], "https://cache.pleroma.social")

	media_url = "https://mycdn.akamai.com"

	url = "#{media_url}/static/logo.png"
	encoded = url(url)

	assert String.starts_with?(encoded, media_url)
	end

	test "ensure Pleroma.Upload base_url is always whitelisted" do
	media_url = "https://media.pleroma.social"
	Pleroma.Config.put([Pleroma.Upload, :base_url], media_url)

	url = "#{media_url}/static/logo.png"
	encoded = url(url)

	assert String.starts_with?(encoded, media_url)
	end
	end
	end

File Metadata

Mime Type: text/x-diff
Expires: Thu, Oct 29, 10:35 PM (1 d, 17 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1798782
Default Alt Text: (49 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions